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Dear Sir / Madam, 


Remote on-boarding of individual customers 


I am writing to provide feedback and articulate the HKMA’s regulatory expectation in 
respect of remote on-boarding’ of individual customers, based on observations and 
insights gathered through the HKMA Fintech Supervisory Sandbox and Chatroom as 
well as use cases of customer remote on-boarding initiatives of authorized institutions 
(AIs). 


Globally, technology is changing customer expectations and also presenting 
Opportunities, when applied appropriately, for more effective management of, inter 
alia, money laundering and terrorist financing (ML/TF) risks. The HKMA supports 
technology and innovation, and some Als have already started on-boarding individual 
customers remotely through electronic channels such as mobile applications or 
internet, while others are exploring and/or testing options and solutions. 


When compared with current operating models of on-boarding customers, remote 
on-boarding may present greater risks to Als, particularly for impersonation risks. 
There are also factors which aggravate the risks, such as the speed of electronic 
transactions, the ease of making multiple fictitious account applications and the use of 
stolen identities which, when made remotely, may be more challenging to be deterred 
and detected. 


Als are required to conduct customer due diligence (CDD) measures before 
establishing business relationships with customers as specified in the Anti-Money 
Laundering and Counter-Terrorist Financing Ordinance and the Guideline on Anti- 
Money Laundering and Counter-Financing of Terrorism (For Authorized Institutions) 
(AML/CFT Guideline), which permit on-boarding of customers remotely. AIs should 
employ technology solutions appropriate to mitigate the risks when identifying and 
verifying the identity of an individual customer. The HKMA expects that any 
technology solutions adopted by Als for remote on-boarding~ should be at least as 


For the purpose of this circular, the term “remote on-boarding” refers to establishing a business 
relationship with a customer solely through an electronic channel such as mobile applications or 
internet. 

For example, the “eID” being developed as one of the key infrastructure projects for smart city 
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robust as those performed when the customer is in front of the staff of an AI, and 
cover the following two aspects”: 


(i) 


Gi) 


identity authentication — where the individual customer’s identity is 
obtained through electronic channels, such as transmission of a document 
image acquired by mobile application, AIs should take appropriate 
measures to ensure reliability of the document, data or information obtained 
for the purpose of verifying the customer’s identity. This includes utilising 
technology to ascertain the genuineness of the identity document by, for 
example using holograms detection or detection of security features of 
identity documents; and 


identity matching — Als should use appropriate technology (e.g. biometric 
solutions like facial recognition and liveness detection) to link the customer 
incontrovertibly to the identity provided in (i). 


Prior to the launch of a remote on-boarding initiative, Als should conduct ML/TF risk 
assessments’ proportionate to the nature, size and complexity of their businesses and 
thereafter monitor and manage the effectiveness of the technology adopted on an 
ongoing basis, particularly during early stages of implementation and operation. For 
the avoidance of doubt, Als should also comply with all applicable legal and 
regulatory requirements” in their conduct of businesses. Als are also reminded to 
apply a risk-based approach when conducting CDD measures and the extent of CDD 
measures should be commensurate with the ML/TF risk associated with a business 
relationship”. 


Should you have any questions regarding this letter, please contact us at 


aml@hkma.iclnet.hk. 


Yours faithfully, 


Carmen Chu 
Executive Director (Enforcement and AML) 


development announced in Policy Address 2017 would be an acceptable technology solution for 
remote on-boarding. 


The examples provided are for illustrative purpose and are non-exhaustive. 


: See paragraphs 2.10 and 2.11 of the AML/CFT Guideline. 


Including but not limited to guidance issued by the HKMA on technology and E-banking risk 


management 


Reference can be made to various guidance issued by the HKMA including, for example, 


AML/CFT Guideline and the circular on “De-risking and Financial Inclusion” of 8 September 


2016. 


